New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 877767 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Sep 20
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

CHECK failure: FinalAssessment::cast(assessment)->virtual_register() == virtual_register in reg

Project Member Reported by ClusterFuzz, Aug 25

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5436877461782528

Fuzzer: binaryen_wasm_fuzzer
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  FinalAssessment::cast(assessment)->virtual_register() == virtual_register in reg
  v8::internal::compiler::RegisterAllocatorVerifier::ValidateUse
  v8::internal::compiler::RegisterAllocatorVerifier::VerifyGapMoves
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=55415:55416

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5436877461782528

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Aug 25

Components: Blink>JavaScript>Compiler
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Aug 25

Labels: Test-Predator-Auto-Owner
Owner: gdeepti@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/8fe01fea4e1d7591645f89fb155a6a6bd89ed3b4 ([arm] Implement I64Atomic operations on Arm).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 3 by sheriffbot@chromium.org, Aug 25

Labels: Pri-1
Labels: M-70 Security_Impact-None
gdeepti -- can you please comment on what happens in the absence of this CHECK?
It doesn't seem like it leads to any security issue so setting Security_Impact-None.
Components: -Blink>JavaScript -Blink>JavaScript>Compiler Blink>JavaScript>WebAssembly
Security_Impact-None is correct as this will only be executed behind a flag, and the case that this is hitting is when the output nodes are optimized, this is the first in the series of checks to make sure that nothing unexpected happens. Fix is WIP, this can probably be merged with 877791, but I'll confirm once I can test the fix on both these cases. 
Labels: Merge-Request-70
Status: Fixed (was: Assigned)
This is fixed by - https://chromium-review.googlesource.com/c/v8/v8/+/1195910. Will need to be merged to M70 though. 
Project Member

Comment 7 by sheriffbot@chromium.org, Sep 20

Labels: -Merge-Request-70 Merge-Review-70 Hotlist-Merge-Review
This bug requires manual review: M70 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: benmason@(Android), kariahda@(iOS), geohsu@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 8 by ClusterFuzz, Sep 20

Labels: -M-70 Fuzz-Blocker ReleaseBlock-Beta M-71
This crash occurs very frequently on linux platform and is likely preventing the fuzzer binaryen_wasm_fuzzer from making much progress. Fixing this will allow more bugs to be found.

Marking this bug as a blocker for next Beta release.

If this is incorrect, please add ClusterFuzz-Wrong label and remove the ReleaseBlock-Beta label.
Project Member

Comment 9 by sheriffbot@chromium.org, Sep 21

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 10 by sheriffbot@chromium.org, Sep 21

Labels: -ReleaseBlock-Beta
Labels: -Merge-Review-70 Merge-Approved-70
Project Member

Comment 12 by sheriffbot@chromium.org, Sep 25

Cc: abdulsyed@chromium.org
This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: -Hotlist-Merge-Review -Merge-Approved-70
There's a bigger refactoring change that needs that this depends on, that did not make it to M70. I'm going to defer merging this for now - removing merge labels. 
Project Member

Comment 14 by ClusterFuzz, Sep 27

Labels: Needs-Feedback
ClusterFuzz testcase 5436877461782528 is still reproducing on tip-of-tree build (trunk).

Please re-test your fix against this testcase and if the fix was incorrect or incomplete, please re-open the bug. Otherwise, ignore this notification and add ClusterFuzz-Wrong label.
Labels: -reward-topanel reward-0
I'm afraid the VRP panel declined to reward for this, as this bug would have been fixed without this report (see https://bugs.chromium.org/p/v8/issues/detail?id=6532)

Cheers!
Project Member

Comment 16 by ClusterFuzz, Oct 4

ClusterFuzz has detected this issue as fixed in range 56359:56360.

Detailed report: https://clusterfuzz.com/testcase?key=5436877461782528

Fuzzer: binaryen_wasm_fuzzer
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  FinalAssessment::cast(assessment)->virtual_register() == virtual_register in reg
  v8::internal::compiler::RegisterAllocatorVerifier::ValidateUse
  v8::internal::compiler::RegisterAllocatorVerifier::VerifyGapMoves
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=55415:55416
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=56359:56360

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5436877461782528

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 17 by ClusterFuzz, Oct 4

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5436877461782528 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 18 by sheriffbot@chromium.org, Dec 28

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment